RHSA-2026:69906HighCVSS 8.8

Red Hat Security Advisory: kernel security update

Published
September 22, 2026
Last Modified
September 24, 2026

🔗 CVE IDs covered (6)

CVE-2023-53781 →CVE-2026-46150 →CVE-2026-52993 →CVE-2026-53002 →CVE-2026-64268 →CVE-2026-64564 →

📋 Description

CVE-2023-53781 — kernel: smc: Fix use-after-free in tcp_write_timer_handler() CVE-2026-46150 — kernel: fanotify: fix false positive on permission events CVE-2026-52993 — kernel: tipc: fix double-free in tipc_buf_append() CVE-2026-53002 — kernel: netfilter: conntrack: remove sprintf usage CVE-2026-64268 — kernel: Kernel: Remote out-of-bounds write in RDMA/siw CVE-2026-64564 — kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing

🎯 Affected products123

  • Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • bpftool-0:4.18.0-372.216.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • bpftool-0:4.18.0-372.216.1.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • bpftool-0:4.18.0-372.216.1.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • bpftool-0:4.18.0-372.216.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • bpftool-0:4.18.0-372.216.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.216.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.216.1.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.216.1.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.216.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.216.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-0:4.18.0-372.216.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-0:4.18.0-372.216.1.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-0:4.18.0-372.216.1.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-0:4.18.0-372.216.1.el8_6.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-0:4.18.0-372.216.1.el8_6.src as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-0:4.18.0-372.216.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-0:4.18.0-372.216.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-abi-stablelists-0:4.18.0-372.216.1.el8_6.noarch as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-abi-stablelists-0:4.18.0-372.216.1.el8_6.noarch as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-core-0:4.18.0-372.216.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-core-0:4.18.0-372.216.1.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-core-0:4.18.0-372.216.1.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-core-0:4.18.0-372.216.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-core-0:4.18.0-372.216.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debug-0:4.18.0-372.216.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debug-0:4.18.0-372.216.1.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debug-0:4.18.0-372.216.1.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debug-0:4.18.0-372.216.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • +93 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent the nf_conntrack_sip and nf_nat_sip modules from being loaded. See https://access.redhat.com/solutions/41278 for instructions. Workaround: To mitigate this issue, prevent the `siw` kernel module from loading. Create a file `/etc/modprobe.d/blacklist-siw.conf` with the following content: ``` blacklist siw install siw /bin/true ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect: ```bash dracut -f -v reboot ``` This mitigation will disable the Soft iWARP functionality, which may impact applications relying on it. A system reboot is required for the changes to be fully applied. Workaround: To mitigate this issue, prevent the `sctp` kernel module from loading. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the following content: ``` install sctp /bin/true blacklist sctp ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix.

🔗 References (9)